An enterprise is architecting a mission-critical hybrid network topology connecting an on-premises data center to Google Cloud. The architecture must satisfy the following technical and operational requirements: Connect on-premises networks to multiple isolated workload VPCs (production and development) through a scalable hub-and-spoke model Enforce centralized Layer 7 deep packet inspection and filtering on all traffic flowing between on-premises and the cloud workload VPCs Distribute traffic across redundant Network Virtual Appliance (NVA) firewall instances with symmetric session handling Prevent route table overflow and route flapping by controlling prefix announcements over BGP sessions to on-premises routers Which hybrid networking design should you implement?

Deploy a transit hub VPC with an internal passthrough Network Load Balancer fronting a managed instance group of NVAs as the next hop for peered spoke VPCs, terminate redundant Cloud Interconnect VLAN attachments in the transit network, and configure Cloud Routers with summary custom route advertisements.: ### What the Solution Is This architecture establishes a **centralized transit hub-and-spoke topology** that uses **Cloud Interconnect** for high-throughput, redundant hybrid connectivity. It leverages an **internal passthrough Network Load Balancer** as a next hop to distribute traffic evenly across a **managed instance group (MIG)** of firewall **Network Virtual Appliances (NVAs)**, while using **Cloud Router summary custom advertisements** to manage BGP prefix scale. ### How It Meets the Requirements - **Hub-and-Spoke Connectivity**: The transit hub VPC connects to on-premises via **Cloud Interconnect** using multiple **VLAN attachments** and peers with isolated spoke VPCs (such as production and development), creating a clean separation of network environments. - **Centralized Layer 7 Inspection**: Traffic entering from on-premises or moving across spoke VPCs is routed through virtual appliance firewalls deployed in the central hub VPC. - **High Availability and Symmetric Handling**: The **internal passthrough Network Load Balancer** distributes traffic across healthy NVA instances in the MIG. Google Cloud's **symmetric hashing** ensures bidirectional traffic flows through the same NVA without requiring Source NAT (SNAT). - **BGP Optimization and Prefix Scale**: Configuring **summary custom advertisements** on the **Cloud Router** condenses cloud network ranges into aggregated prefixes, preventing routing table limits and instability on on-premises BGP neighbors. ### Key Advantages - **Enterprise-Grade Availability**: Redundant VLAN attachments and autoscaling NVA backends eliminate single points of failure. - **Centralized Security Governance**: Security teams manage deep packet inspection rules in one place rather than configuring per-spoke appliances. - **Predictable Routing**: Custom prefix summarization prevents route churn and adheres to hardware route limits on on-premises routers. - **No Complex SNAT Overhead**: Preserves original client IP addresses across hybrid flows via symmetric load balancing. ### Why This Is Optimal Combining a transit hub VPC with an internal load balancer as the next hop provides the resilience, scalability, and deep inspection required by enterprise landing zones without compromising routing stability.

StudyCerts

Hybrid Hub Spoke Nva Interconnect Routing | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Hybrid Hub Spoke Nva Interconnect Routing

Section: Extending to on-premises environments (hybrid networking)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is architecting a mission-critical hybrid network topology connecting an on-premises data center to Google Cloud. The architecture must satisfy the following technical and operational requirements:

Connect on-premises networks to multiple isolated workload VPCs (production and development) through a scalable hub-and-spoke model
Enforce centralized Layer 7 deep packet inspection and filtering on all traffic flowing between on-premises and the cloud workload VPCs
Distribute traffic across redundant Network Virtual Appliance (NVA) firewall instances with symmetric session handling
Prevent route table overflow and route flapping by controlling prefix announcements over BGP sessions to on-premises routers

Which hybrid networking design should you implement?

Deploy a transit hub VPC with an internal passthrough Network Load Balancer fronting a managed instance group of NVAs as the next hop for peered spoke VPCs, terminate redundant Cloud Interconnect VLAN attachments in the transit network, and configure Cloud Routers with summary custom route advertisements.

Deploy an external Application Load Balancer in the transit VPC to inspect internal RFC 1918 traffic, and configure Cloud Routers to redistribute raw default static routes (0.0.0.0/0) directly into on-premises BGP tables without filtering.

Deploy a single Compute Engine VM configured as an NVA router in the hub VPC, use static host routes pointing to that VM's IP address, and disable Cloud Router BGP dynamic routing.

Connect each spoke VPC directly to on-premises routers using individual single-tunnel Cloud VPN gateways, assign a public IP to each workload VM, and advertise specific /32 host routes via BGP.

Professional Cloud Architect

Hybrid Hub Spoke Nva Interconnect Routing

Related questions